I am using this command with tshark:

tshark -r pcapfile "tcp and ip.src==" -T text -V -x | grep 'Total Length'

This essentially parses the pcap for only connections from the source ip and looks for the total length in bytes from each packet. I get output like this:

Total Length: 125

Total Length: 210

Total Length: 40

Total Length: 125

etc, etc....

What I need to do is take the numbers from Total Length and add them up so I can get an idea of how much data was passed over the wire in the time frame of the pcap from a single IP. Is there a command I can add on the end of the one I am using to do this?

1 Answer 1


You could pipe to awk with something like:

awk '{totalbytes+=$3}END{printf("Total bytes: %d\n",totalbytes)}'

Just divide by 1024 to get kB if you prefer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .